For some reason we sometimes get an error when trying to save contact information after editing. An error pop-up appears with Illegal characters in input (potential scripting attack) when trying to save. It turns out that this can be solved by deleting the contents of the Email signature field (even though there are no visible contents). So I assume that there must be some invisible character in this field, but how did it get there (we never use this field)? And how can I suppress the signature field, so that this problem doesn't happen again? Thanks.

Edit: Civi 4.7.3 (but also happened in earlier versions). Joomla 3.4.8. MySQL 5.5.47 PHP 5.6.18 Centos 6.6.

  • What is your version of CiviCRM, and what platform are you on?
    – JohnFF
    Mar 4, 2016 at 15:57
  • I'm confused by deleting the contents when there are no visible contents. What are the contents that are not visible?
    – JohnFF
    Mar 5, 2016 at 1:50
  • I don't know. It doesn't show up in the HTML source as far as I can see. Maybe a character coding effect? If I select the field, select all and delete, then the form saves OK without the error. I will look more closely next time it happens. Part of my reason for posting was so that if anyone else has this problem, they would look at the signature field - it took us quite a while to identify that this was the field causing the problems.
    – Jern
    Mar 5, 2016 at 8:11
  • If there are mystery characters there that you can actually select and copy (Ctrl-A Ctrl-C), and you're using Linux (and have the hexdump command), you could do something like echo -n "<paste them here>" | hexdump -C to find out exactly what characters they are. Just out of interest, doesn't tell you where they came from though. This helped me find UTF-8 apostrophes in someone's username once- they had been doing a password reset every day!
    – DaveFF
    Mar 8, 2016 at 17:32

2 Answers 2


I think that you have a browser plugin installed which is interfering with CiviCRM.

For example, this page suggests that it may be a Firefox addon called "YouTube Auto HD".


For troubleshooting purposes, I'd suggest trying each of these to gain more info:

  • Try with a different web browser (i.e. Chrome vs Firefox).
  • Try the same browser, but with all extensions/plugins/addons disabled.
  • Try clearing your browser cache.


Hopefully the above steps allow you to learn more about the root cause of the problem. So if disabling all your browser plugins did the trick then you could try disabling them one-by-one to find the culprit.


Then if you do find that one plugin is giving you trouble with CiviCRM and keeping that plugin installed is important, then I'd suggest either:

  • contacting the plugin author to complain about its behavior
  • finding a suitable replacement plugin that doesn't have the problem

In theory you could submit a bug report to CiviCRM, but given the behavior you've described, I think it's unlikely that we'd be able to easily change CiviCRM to make it compatible with a browser plugin like this.

  • Thanks. This was a while ago. I never did get to the bottom of it, but the issue has since disappeared.
    – Jern
    Sep 16, 2017 at 6:46

The problem has appeared again, so I checked the page source. In the email signature field (which appears blank), there is:

<p>  <br></p><!--{cke_protected}%3Cscript%20charset%3D%22UTF-8%22%20src%3D%22chrome%3A%2F%2Fhdv%2Fcontent%2Fhdv.js%22%20type%3D%22application%2Fjavascript%22%3E%3C%2Fscript%3E-->

Anyone know where this comes from, and if it could be cause the "illegal characters" error? Thanks.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.